My Computer is ruined! I deleted the real svchost.exe

Now I can'r run any programs except for firefox and a couple others.
I can't repair it using the windows 2000 setup disc because I didn't install it on here and don't have it.

Could I download it from somewhere?

ATNO/TW

Super Moderator

Posts: 23473

Loc: Woodbridge VA

3+ Months Ago

http://atnopro.com/ozzu/svchost.exe

I'm using Win2K Pro
That's the real file I have on my machine.

Click it, or Right click and save then copy it to Winnt/System32

pepsidemon

Newbie

Posts: 10

3+ Months Ago

i think it was deleted in the system registry as well, how do i fix the registry?

ATNO/TW

Super Moderator

Posts: 23473

Loc: Woodbridge VA

3+ Months Ago

Not sure. Not entirely certain what you'd done so far, but this may give some explanations you haven't seen yet.

http://ask-leo.com/archives/000105.html

Ragnar78

Proficient

Posts: 279

3+ Months Ago

I dont know if this might help but the Tool 'RegServ32.exe' that can be found in 'systemroot%\system32' is used to register component like ActiveX and DLL and i guess also Executables...
So all you have to do is to type in run: regserv32 svchost.exe
(NO GARANTIES, i only use it for activex or DLL i create with VB)

And as for finding it, it shout be on the windows CD and all you have to do is find it and use the Expand.exe command to extract it.

but i do recommand that you reinstall windows, or more precisely, repair it

Smokenjoe

Mastermind

Posts: 1572

Loc: Seattle, WA

3+ Months Ago

Yeah, if you cant repair, or its taking too long, I would just re-install. I dont know about Windows2000, but I run 98SE and its a breeze to re-install. I used to just re-install when I couldnt figure out a problem, lol, so I got good at it.

conorific

Proficient

Posts: 350

Loc: NY

3+ Months Ago

Just a question: why'd you delete svchost.exe?

ATNO/TW

Super Moderator

Posts: 23473

Loc: Woodbridge VA

3+ Months Ago

THere's a couple viruses that copy a svchost.exe file in a different directory. If you're not watching what you're doing it's easy to mistake the real one for the virus file.

DuckIT

Graduate

Posts: 155

Loc: London, UK

3+ Months Ago

Theres also a couple of cleverly, similar named viruses, that even if you know roughly whats in your processes list its easy to miss them. Look closely at the spellings!:

svchosts - svchosts.exe - Process Information
Process File: svchosts or svchosts.exe
Process Name: Svchosts
Description: Added to the System as a result of the Sdbot-N VIRUS! whic is a backdoor Trojan which allows a remote user unauthorised access and control over the computer via IRC channels.It runs in the background as a service process and attempts to connect to an IRC server and join a specific channel.then listens on the IRC channel for specific commands and carries out the appropriate actions.
Company: N/A
System Process: No
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): Yes

svshost - svshost.exe - Process Information
Process File: svshost or svshost.exe
Process Name: Svshost
Description: Added to the system as a result of Worm.P2P.Spybot.gen Virus which spreads through peer to peer (P2P) sharing than through open Windows file shares.Once spread out, the infected systems are scanning for unprotected Windows file shares.
Company: N/A
System Process: No
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): Yes

What fun

S

ThATKiD

Proficient

Posts: 321

Loc: somewere over there

3+ Months Ago

i have the same virus i think nortons told me it was w32.jeebo not sure how to get rid of it. any one know how ::cough atno cough::

ATNO/TW

Super Moderator

Posts: 23473

Loc: Woodbridge VA

3+ Months Ago

ThATKiD' wrote:

i have the same virus i think nortons told me it was w32.jeebo not sure how to get rid of it. any one know how ::cough atno cough::

What you have is more than likely W32.Jeefo (W32.Jeebo doesn't exist in symantecs virus definitions list and it wouldn't have caught it).

Here are the removal instructions for W32.Jeefo

http://securityresponse.symantec.com/av ... jeefo.html

conorific

Proficient

Posts: 350

Loc: NY

3+ Months Ago

Haha. I think we all sort of turn to ATNO/TW when we have a question. He is decidedly Assistant God of this forum.

ATNO/TW

Super Moderator

Posts: 23473

Loc: Woodbridge VA

3+ Months Ago

conorific wrote:

He is decidedly Assistant God of this forum.

I would certainly have to disagree with that. You have no idea how much I am helped by others here. It's a give and take, and I have learned much by being part of this great community.

Smokenjoe

Mastermind

Posts: 1572

Loc: Seattle, WA

3+ Months Ago

Yeah, and I have to say thats one thing I like about Ozzu. I have a decent know-how of computers, and its nice to have aresource to come to when I have no idea what to do! Im just happy when I can help someone everyonce in a while.

ThATKiD

Proficient

Posts: 321

Loc: somewere over there

3+ Months Ago

atcually atno i only realized i had it because i periodicly hceck nortons event log and it said that it had detected w32.jeebo but couldnt remove. thanks alot though im going to try that out and see if i can get rid of this nuesence.

masterchief92173

Born

Posts: 3

3+ Months Ago

Hi, I have a virus on my computer called the w32 Jeefo virus. I run Norton Antivirus but it can only quarantine some of the files. I have a problem with SVC Host. I heard if it is deleted your computer will not function and I dont know if I should quarantine it. Can some body please help me and tell me how to fix SVC host? Thanks...

JrzyCrim

Mastermind

Posts: 2062

3+ Months Ago

Hello masterchief, welcome to Ozzu. See if this page is of any help:
http://securityresponse.symantec.com/av ... jeefo.html

You will find removal instructions further down the page. Please feel free to ask for additional help if needed.

If I may ask, what operating system are you using and in what directory was the infected svchost file found?

masterchief92173

Born

Posts: 3

3+ Months Ago

I did everything it said on this page except for deleting all programs infected because svc host is infected under C:\WINDOWS\svchost.exe I think deleteing this woulnt be to good for my computer. I am running on Windows XP. I quarantined everything that wasnt able to be repaired except svc host. Any ideas?

JrzyCrim

Mastermind

Posts: 2062

3+ Months Ago

The real svchost.exe is in c:\windows\system32. The one that is infected is in C:\windows and is safe to remove.

If it will make you feel better, just move that file to another location and rename it. If something does go wrong, it can be restored later. I'm pretty confident that it is safe to remove, however. It tries to disguise itself as the real svchost.exe and you won't notice it in the Task Manager. The fact that it is present in C:\windows\ is telling. I'm Running XP Pro and that file is not present on my system.

masterchief92173

Born

Posts: 3

3+ Months Ago

hey thanks man, it worked.

JrzyCrim

Mastermind

Posts: 2062

3+ Months Ago

You're welcome. These viruses are sneaky like that.

ejsky72

Born

Posts: 1

3+ Months Ago

ATNO/TW wrote:

http://atnopro.com/ozzu/svchost.exe

I'm using Win2K ProThat's the real file I have on my machine.

Click it, or Right click and save then copy it to Winnt/System32

I also deleted svchost.exe in the system32 folder thinking it was a virus. I'm running Windows XP Media Center. I retrieved the file from my other computer and put it on a thumbdrive. However, the problem lies in getting it back into the system 32 folder. I believe deleting svchost.exe made it impossible to copy + paste OR click and drag the file. Are there any other options? Thank you in advance for the help. This forum is a lifesaver.

Bogey

Genius

Posts: 8488

Loc: USA

3+ Months Ago

DuckIT wrote:

Theres also a couple of cleverly, similar named viruses, that even if you know roughly whats in your processes list its easy to miss them. Look closely at the spellings!:

svchosts - svchosts.exe - Process Information

Process File: svchosts or svchosts.exe

Process Name: Svchosts

Description: Added to the System as a result of the Sdbot-N VIRUS! whic is a backdoor Trojan which allows a remote user unauthorised access and control over the computer via IRC channels.It runs in the background as a service process and attempts to connect to an IRC server and join a specific channel.then listens on the IRC channel for specific commands and carries out the appropriate actions.

Company: N/A

System Process: No

Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): Yes

svshost - svshost.exe - Process Information

Process File: svshost or svshost.exe

Process Name: Svshost

Description: Added to the system as a result of Worm.P2P.Spybot.gen Virus which spreads through peer to peer (P2P) sharing than through open Windows file shares.Once spread out, the infected systems are scanning for unprotected Windows file shares.

Company: N/A

System Process: No

Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): Yes

What fun

If that is true than I don't have any REAL svchost (svchosts.exe process) running on my computer. I checked my task manager and it had about 8 svchost.exe and non svchosts.exe.

Some of those svchost.exe Local Service, Some are Networking service but most of them are System.

Should I be concerned?

---

To ejsky72. Can't you right click and click Save As and navigate to System32 folder? Just a thought.

windowshater123

Born

Posts: 4

Loc: Mississauga ontario

3+ Months Ago

i deleted my svchost on a different os on the same computor because avast said it wus a virus please help every thing is now messed on my xp pro it looks like win 98 and all processess are stoped and i cant do anything(copy,paste,drag etc...)

i have no cd for xp i need help please reply

windowshater123

Born

Posts: 4

Loc: Mississauga ontario

3+ Months Ago

i deleted my svchost on a different os on the same computor because avast said it wus a virus please help every thing is now messed on my xp pro it looks like win 98 and all processess are stoped and i cant do anything(copy,paste,drag etc...)

i have no cd for xp i need help please reply........ i need help please help

SpooF

٩๏̯͡๏۶

Posts: 3423

Loc: Richland, WA

3+ Months Ago

Well the hard way would to install a Linux partition and then use it to copy your svchost file back to the correct place. Or you could back up your data and fromat.

Alkatr0z

Mastermind

Posts: 1883

Loc: Adelaide, Australia

3+ Months Ago

Why not just use a LiveCD like Bart's PE or a linux Live CD?
Of if you reboot into the Recovery Console you can see if the following commands work:

Quote:

cd system32cd dllcachecopy svchost.exe ../svchost.exe

If that last command brings up any errors then it hasn't copied the file. I think it should copy alright though.
Check this page for instructions on how to start up in Recovery Console:
http://support.microsoft.com/kb/314058

windowshater123

Born

Posts: 4

Loc: Mississauga ontario

3+ Months Ago

thx albratoz ill look in to it

windowshater123

Born

Posts: 4

Loc: Mississauga ontario

3+ Months Ago

hi i cant find this :Winnt32.exe utility with the /cmdcons

Alkatr0z

Mastermind

Posts: 1883

Loc: Adelaide, Australia

3+ Months Ago

Its on your XP CD. Easiest way if you havent' already installed it is to use the method there where you boot up with your XP CD in the CD drive and use the steps listed to enter the recovery console.

Quote:

Use the Windows Setup floppy disks or the Windows CD-ROM to start your computer. At the "Welcome to Setup" screen, press F10 or press 'R" to repair.